Latest / The Digital Warfare Podcast
EP. 183: BeyondTrust Zero-Day Turned Remote Support Appliances Into Root-Level Attack Platforms
Summary
BeyondTrust disclosed CVE-2026-102764, a critical CVSS 9.3 vulnerability affecting Remote Support appliances. The flaw stems from improper origin validation in an internal messaging component and can allow a remote unauthenticated attacker to perform file operations on affected systems.
The suspected China-nexus group ARMORY CASTLE exploited the flaw as a zero-day, escalated to root privileges, deployed SAWFLY and BARECLAW, erased logs, accessed appliance-brokered credentials, and moved laterally using compromised administrator accounts.
Key Takeaways
• CVE-2026-102764 carries a CVSS…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.